Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ownbackup/ob-query-builder (npm) MAL-2025-192706 | Malicious | Not scored | 23 Dec, 2025 | npm @ownbackup/ob-query-builder |
Malicious release: Malicious code in @ownbackup/ob-design-system (npm) MAL-2025-192704 | Malicious | Not scored | 23 Dec, 2025 | npm @ownbackup/ob-design-system |
Malicious release: Malicious code in @ownbackup/icons (npm) MAL-2025-192703 | Malicious | Not scored | 23 Dec, 2025 | npm @ownbackup/icons |
Malicious release: Malicious code in @ownbackup/data-chart (npm) MAL-2025-192701 | Malicious | Not scored | 23 Dec, 2025 | npm @ownbackup/data-chart |
Malicious release: Malicious code in @ownbackup/data-grid (npm) MAL-2025-192702 | Malicious | Not scored | 23 Dec, 2025 | npm @ownbackup/data-grid |
Malicious release: Malicious code in @ads-core/types (npm) GHSA-6xvr-cfwp-7mv9, MAL-2025-192700 | Malicious | Not scored | 23 Dec, 2025 | npm @ads-core/types |
Malicious release: Malicious code in mw-frontend-utils (npm) GHSA-337v-g6xp-2crp, MAL-2025-192697 | Malicious | Not scored | 22 Dec, 2025 | npm mw-frontend-utils |
Malicious release: Malicious code in ro-mobile (npm) GHSA-85m3-w425-6v48, MAL-2025-192698 | Malicious | Not scored | 22 Dec, 2025 | npm ro-mobile |
Malicious release: Malicious code in @vienna_cancer_center_portal/js (npm) GHSA-98m9-fmm5-76w2, MAL-2025-192692 | Malicious | Not scored | 22 Dec, 2025 | npm @vienna_cancer_center_portal/js |
Malicious release: Malicious code in dc-extras (npm) GHSA-cfqp-cvx7-r4w3, MAL-2025-192694 | Malicious | Not scored | 22 Dec, 2025 | npm dc-extras |
Malicious release: Malicious code in mui-wrapper-core (npm) GHSA-m8v6-5crc-5m6w, MAL-2025-192696 | Malicious | Not scored | 22 Dec, 2025 | npm mui-wrapper-core |
Malicious release: Malicious code in airslate-dep-webpack (npm) MAL-2025-192693 | Malicious | Not scored | 22 Dec, 2025 | npm airslate-dep-webpack |
Malicious release: Malicious code in ivx-cloud-client-v1 (npm) MAL-2025-192695 | Malicious | Not scored | 22 Dec, 2025 | npm ivx-cloud-client-v1 |
Fedify has ReDoS Vulnerability in HTML Parsing Regex CVE-2025-68475, GHSA-rchf-xwx2-hm93 | High | 0.6% | 22 Dec, 2025 | npm @fedify/fedify |
Malicious release: Malicious code in cloudy-uvi-sense-v11 (npm) MAL-2025-192691 | Malicious | Not scored | 22 Dec, 2025 | npm cloudy-uvi-sense-v11 |
Malicious release: Malicious code in utif-updated (npm) GHSA-j9gx-q4v7-8gh6, MAL-2025-192688 | Malicious | Not scored | 22 Dec, 2025 | npm utif-updated |
Malicious release: Malicious code in tiny-model-update (npm) GHSA-7m8x-5j4f-qj6p, MAL-2026-47 | Malicious | Not scored | 22 Dec, 2025 | npm tiny-model-update |
Malicious release: Malicious code in commander-stable (npm) GHSA-mmcm-p5h7-xjhw, MAL-2025-192687 | Malicious | Not scored | 22 Dec, 2025 | npm commander-stable |
Malicious release: Malicious code in secguest-lib (npm) GHSA-33c5-f4q2-c358, MAL-2026-169 | Malicious | Not scored | 22 Dec, 2025 | npm secguest-lib |
Malicious release: Malicious code in github-badge-bot (npm) GHSA-r39w-33gw-8p5g, MAL-2026-46 | Malicious | Not scored | 21 Dec, 2025 | npm github-badge-bot |
Malicious release: Malicious code in meta-code-verify (npm) GHSA-vwm7-m2x4-j99q, MAL-2026-134 | Malicious | Not scored | 21 Dec, 2025 | npm meta-code-verify |
Malicious release: Malicious code in @nosinovacao/nosid-mfe-common (npm) GHSA-3xxx-vrmx-pg3x, MAL-2025-192682 | Malicious | Not scored | 20 Dec, 2025 | npm @nosinovacao/nosid-mfe-common |
Malicious release: Malicious code in othw (npm) MAL-2025-192681 | Malicious | Not scored | 20 Dec, 2025 | npm othw |
Malicious release: Malicious code in escaux-scrumboard-api (npm) MAL-2025-192680 | Malicious | Not scored | 20 Dec, 2025 | npm escaux-scrumboard-api |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature GHSA-24v3-254g-jv85 | Low | Not scored | 19 Dec, 2025 | npm @tutao/tutanota-utils |
Malicious release: Malicious code in jest-stable (npm) MAL-2025-192678 | Malicious | Not scored | 19 Dec, 2025 | npm jest-stable |
Malicious release: Malicious code in shakti20261 (npm) GHSA-357m-gr33-h5ww, MAL-2025-192677 | Malicious | Not scored | 19 Dec, 2025 | npm shakti20261 |
Orejime has executable code in HTML attributes CVE-2025-68457, GHSA-72mh-hgpm-6384 | Low | 0.2% | 19 Dec, 2025 | npm orejime |
Malicious release: Malicious code in wifi-killer-xnet (npm) GHSA-3jp3-7hvx-xvrp, MAL-2025-192672 | Malicious | Not scored | 19 Dec, 2025 | npm wifi-killer-xnet |
Malicious release: Malicious code in zebracros-bahlil (npm) GHSA-3jvv-6p8r-85xm, MAL-2025-192676 | Malicious | Not scored | 19 Dec, 2025 | npm zebracros-bahlil |
Malicious release: Malicious code in adeliana-xnetgpt (npm) GHSA-5vvc-ghph-2q6r, MAL-2025-192662 | Malicious | Not scored | 19 Dec, 2025 | npm adeliana-xnetgpt |
Malicious release: Malicious code in xnetgpt (npm) GHSA-5xjm-7w5x-5r5h, MAL-2025-192674 | Malicious | Not scored | 19 Dec, 2025 | npm xnetgpt |
Malicious release: Malicious code in adel-xnetgpt (npm) GHSA-cj6p-hpgc-rf68, MAL-2025-192661 | Malicious | Not scored | 19 Dec, 2025 | npm adel-xnetgpt |
Malicious release: Malicious code in nmapchecker (npm) GHSA-cw79-7675-r9wh, MAL-2025-192669 | Malicious | Not scored | 19 Dec, 2025 | npm nmapchecker |
Malicious release: Malicious code in ddos-gacor-v2 (npm) GHSA-gj5x-fhwg-4hqp, MAL-2025-192668 | Malicious | Not scored | 19 Dec, 2025 | npm ddos-gacor-v2 |
Malicious release: Malicious code in xnetgpt-lite (npm) GHSA-j59m-fvrw-mr87, MAL-2025-192675 | Malicious | Not scored | 19 Dec, 2025 | npm xnetgpt-lite |
Malicious release: Malicious code in sonia3-npm-js (npm) GHSA-mq4w-m6vr-gm8g, MAL-2025-192670 | Malicious | Not scored | 19 Dec, 2025 | npm sonia3-npm-js |
Malicious release: Malicious code in spamsms (npm) GHSA-rwfg-wjgq-jp43, MAL-2025-192671 | Malicious | Not scored | 19 Dec, 2025 | npm spamsms |
Malicious release: Malicious code in @sodexo-connect/sap-cdc-client (npm) GHSA-cmx2-4gj4-x3h2, MAL-2025-192660 | Malicious | Not scored | 19 Dec, 2025 | npm @sodexo-connect/sap-cdc-client |
Malicious release: Malicious code in asdfgh33 (npm) GHSA-687c-w69p-pvr7, MAL-2025-192664 | Malicious | Not scored | 19 Dec, 2025 | npm asdfgh33 |
Malicious release: Malicious code in xmlwtf3 (npm) GHSA-qjqf-48qf-vvmr, MAL-2025-192673 | Malicious | Not scored | 19 Dec, 2025 | npm xmlwtf3 |
Malicious release: Malicious code in ahmed_salem_o (npm) GHSA-75rh-f487-q44w, MAL-2025-192663 | Malicious | Not scored | 19 Dec, 2025 | npm ahmed_salem_o |
Malicious release: Malicious code in ctfvamp (npm) GHSA-4p2c-4c8x-774p, MAL-2025-192666 | Malicious | Not scored | 19 Dec, 2025 | npm ctfvamp |
Malicious release: Malicious code in ctfvampir (npm) GHSA-j92w-g7pq-jc8x, MAL-2025-192667 | Malicious | Not scored | 19 Dec, 2025 | npm ctfvampir |
Malicious release: Malicious code in baidu-tester (npm) GHSA-2gvp-3425-fwcc, MAL-2025-192665 | Malicious | Not scored | 19 Dec, 2025 | npm baidu-tester |
Malicious release: Malicious code in chai-as-awaited (npm) GHSA-mr3j-pq8x-j9q8, MAL-2025-192622 | Malicious | Not scored | 19 Dec, 2025 | npm chai-as-awaited |
Malicious release: Malicious code in elf-stats-wintry-chimney-348 (npm) GHSA-5x69-3q5p-h54j, MAL-2025-192628 | Malicious | Not scored | 19 Dec, 2025 | npm elf-stats-wintry-chimney-348 |
Malicious release: Malicious code in elf-stats-cocoa-workshop-459 (npm) GHSA-g5f4-9h9x-jr4q, MAL-2025-192626 | Malicious | Not scored | 19 Dec, 2025 | npm elf-stats-cocoa-workshop-459 |
Malicious release: Malicious code in yt-smm (npm) GHSA-6xv9-8hr4-x9q2, MAL-2025-192657 | Malicious | Not scored | 19 Dec, 2025 | npm yt-smm |